National Cyber Awareness System

Vulnerability Summary for CVE-2010-3312

Overview

Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificate.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.gnome.org/show_bug.cgi?id=600663

Hyperlink:https://bugzilla.gnome.org/show_bug.cgi?id=600663

External Source: VUPEN

Name: ADV-2011-0212

Hyperlink:http://www.vupen.com/english/advisories/2011/0212

External Source: MLIST

Name: [oss-security] 20100921 Re: CVE request: epiphany not checking ssl certs

Hyperlink:http://www.openwall.com/lists/oss-security/2010/09/21/5

External Source: MLIST

Name: [oss-security] 20100920 Re: CVE request: epiphany not checking ssl certs

Hyperlink:http://www.openwall.com/lists/oss-security/2010/09/20/2

External Source: MLIST

Name: [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs

Hyperlink:http://www.openwall.com/lists/oss-security/2010/09/17/6

External Source: MLIST

Name: [oss-security] 20100917 CVE request: epiphany not checking ssl certs

Hyperlink:http://www.openwall.com/lists/oss-security/2010/09/17/5

External Source: MLIST

Name: [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs

Hyperlink:http://www.openwall.com/lists/oss-security/2010/09/17/13

External Source: MLIST

Name: [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs

Hyperlink:http://www.openwall.com/lists/oss-security/2010/09/17/12

External Source: MLIST

Name: [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs

Hyperlink:http://www.openwall.com/lists/oss-security/2010/09/17/10

External Source: SECUNIA

Name: 43068

Hyperlink:http://secunia.com/advisories/43068

External Source: SUSE

Name: SUSE-SR:2011:002

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html

External Source: SUSE

Name: SUSE-SR:2010:023

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html

External Source: CONFIRM

Name: http://bugzilla-attachments.gnome.org/attachment.cgi?id=154330

Hyperlink:http://bugzilla-attachments.gnome.org/attachment.cgi?id=154330

External Source: CONFIRM

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690

External Source: MISC

Name: http://blog.fefe.de/?ts=b26ca29d

Hyperlink:http://blog.fefe.de/?ts=b26ca29d